# SYNTHORA DNS CAA Authorization Records (DoH)

> SYNTHORA DNS CAA Authorization Records (DoH) is a paid API for AI agents from doh-caa-records.hergertsynthora.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Retrieves DNS CAA records for a domain via Cloudflare DoH JSON, revealing which Certificate Authorities are authorized to issue TLS certificates for that domain.

## Facts

- Endpoint: POST https://doh-caa-records.hergertsynthora.com/service
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthora-dns-caa-authorization-records-doh-cdaebe26
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KBCb2qOtJ4NVFezFHQvfm

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthora-dns-caa-authorization-records-doh-cdaebe26 -d '<json body>'
```

Example prompt: Can you look up the CAA DNS records for example.com and tell me which Certificate Authorities are authorized to issue TLS certificates for it?

## When to prefer this

Choose this endpoint when you need to programmatically verify DNS CAA policy for a domain as part of certificate issuance validation, supply-chain security checks, or PKI auditing workflows. It is particularly useful when you want privacy-preserving DNS resolution (DoH via Cloudflare rather than plaintext DNS) and need structured JSON output for agent pipelines. Prefer this over raw DNS queries when you need a reliable, pre-parsed, cloud-accessible CAA lookup that returns raw wire-format values alongside human-readable TTL and name fields.

## Known failure modes

- Domain does not exist (NXDOMAIN) — returns empty or error result
- Domain has no CAA records — returns success with empty caa_records array
- Invalid domain format input — may return error or unexpected behavior
- Cloudflare DoH upstream unavailable — service may timeout or return error
- Network timeout reaching Cloudflare endpoint — slow or failed response

## How this service works

Returns Certificate Authority Authorization (CAA) records showing which CAs are permitted to issue TLS certificates for a domain, via Cloudflare DoH JSON. A2A use: certificate-issuance and supply-chain-security agents verify CA policy and flag mis-issuance risk before trusting a host. First 3 calls FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

## Output

A JSON object containing the domain name, a status field, and an array of CAA records each with TTL, name, and raw value (hex-encoded wire format). Also includes provenance metadata showing the Cloudflare DoH URL used as the source.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "domain"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "doh-caa-records",
  "result": {
   "domain": "google.com",
   "status": "success",
   "caa_records": [
    {
     "ttl": 86400,
     "name": "google.com",
     "value": "\\# 15 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67"
    }
   ]
  },
  "provenance": {
   "url": "https://cloudflare-dns.com/dns-query",
   "source": "DNS CAA Authorization Records (DoH)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthora-dns-caa-authorization-records-doh-cdaebe26/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from doh-caa-records.hergertsynthora.com](https://www.zero.xyz/host/doh-caa-records.hergertsynthora.com/llms.txt)